ConfigServer Community Forum

Good morning!
I am new to csf so sorry if this a repeat thread. How do I use the csf firewall app in WHM to white list IP address ranges? The documentation I have read is not very clear.

Thanks in advance.

Eric

Hello

the LFD keeps failing and recovered every fed minutes

The service “lfd” appears to be down.
The system’s command to check or to restart this service failed.

i have tried to investigate the issue by

# service lfd status
Redirecting to /bin/systemctl status lfd.service
● lfd.service - ConfigServer Firewall & Security - lfd
Loaded: loaded (/usr/lib/systemd/system/lfd.service; enabled;...

Hi guys!

I made a custom regex rule that worked in the begging but now looks like it's not triggered anymore.

Here it is:

if (($globlogs{CUSTOM2_LOG}{$lgfile}) and ($line =~ /(\S+).*] \w*(?:POST) .*\/admin\/ HTTP.*301.* /)) {
return ( OC Admin attack ,$1, OC-admin-login , 1 , 80,443 , 8600 );
}

and in the /etc/csf/csf.conf:

CUSTOM3_LOG =...

Hello.

I hope everyone is safe and healthy.

The most recent update (Oct. 4, 2021) of ConfigServer wiped out all my previous settings. Does it make a backup somewhere?

Thank you.

helo
lets say our server has 2 ip A and B.
but i only want to block ip A to access country CN.
how do we achieve that?

cc_deny , yes we can use that but for ip source A and B.. how do we only apply ip A?

I've got a user that keeps getting blocked for a custom LFD rule to block 3 consecutive Worpress failed logins within 3600 seconds. But they swear they are not getting failed logins. The rule is the widely published rule:

if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ /(\S+).*] POST \/wp-login\.php.* 200/)) {
return ( Failed WordPress login from ,$1, wordpress , 5 , 80,443 , 3600 );
}...

Our CS&F works well but we are getting Excessive resource usage warnings that I can't see how to stop using csf.pignore.
And I can't see a solution in the forums.

Our developer uses the Visual Studio Code remote extension and the executable link varies for each hosting account e.g:
Executable: /home/murrayheatingand/.vscode-server/bin/7f6ab5485bbc008386c4386d08766667e155244e/node
Executable:...

Genuine transaction or website access or wordpress-admin updates are blocking csf with the following reason.

Temporary Blocks: IP:157.33.50.133 Port:80 Dir:inout TTL:518400 (Blocked port 80 with Directadmin Brute Force Manager)

How to prevent this or how to prevent the genuine traffics.?? its happening for all.

When Cpanel updates it modifies MANY files. And CSF warns the administrator about these changes.
I have created a feature request on Cpanel that was just approved so the update process try to inform CSF LFD of those changes so it stops barking at it.

Please support this feature request here:

Sorry if this is a dumb question, but what's the difference between the DYNDNS_IGNORE and GLOBAL_DYNDNS_IGNORE settings in csf.conf?

Hello,
i have a new vps with almalinux 8.4 and install csf firewall.
works fine but not block attack on ssh.

i check and found on almalinux there isn't a file
/var/log/secure
(like centos 7).

searching i found that centos 8 / almalinux 8 use journalctl
so if i run in ssh
journalctl _COMM=sshd
i found error (like old log files)

so what i write in /etc/csf/csf.conf
SSHD_LOG = .... ????

thank...

I'm having another issue with CSF blocking inbound emails from Gmail. I logged into multiple gmail accounts and tried to send email to one of our servers and the emails are never received. After I disable CSF firewall i can then receive email from all 3 gmail accounts. I flushed all IP blocks, and added Googles entire IP block 209.85.166.0/255 to CSF ignore. Restarted CSF and still CSF is...

I usually receive a minimum of 50 LFD blocked alerts a day, but yesterday I noticed a sudden decrease to only a handful. This seems like an anomaly, so I am a bit concerned. I haven’t made any changes to the Firewall configuration (except for PT_Usermem) and I’m not seeing any major changes in my server activity. In short, I don’t know if this is a problem or not. Just wondering if anyone has...

I understand that for certain sites, like those that accept credit cards, MaxMind provides fraud prevention. But I don't understand what functions it offers in CFS's Firewall Configuration.

Also wondering if there is a log of MM's activity.

Any insights are appreciated.

I have a fairly new 'large' AWS instance which houses around 40 'not very busy' websites, yet I regularly get a High 5 minute load average alert email.

The that I have just received says:
Time: Thu Sep 2 12:35:36 2021 +0000
1 Min Load Avg: 27.97
5 Min Load Avg: 8.12
15 Min Load Avg: 3.15
Running/Total Processes: 68/395

I compare this to an 'x-large' AWS instance I have that houses 100+...

My website suffer from bad bots and Invalid Traffic bots can i configure csf to stop that

Couldn't find a specific forum for OSM so posting here.
Hi, You installed OSM for us as part of the cpanel services a few months ago. OSM has now sent us a mail report but does not say who the user account sending the mail is or what directory the mail script originated from. Are we missing something? Example:
WHM Report URL:

Report Date:

Fri Nov 22 16:03:44 2019

Report Message:

User...

I've been using OSM for over a year and today I went in and it wasn't running saying it needs PCAP? I'm not sure what has happened, obviously, its been running for a while, so PCAP must have been installed. As I remember OSM isn't a self install, so I don't have the install documents.

Hi team,

It appears on all 8 of our WHM servers csf is no longer blocking the IP address in /etc/csf/csf.deny file. Even when manually added the ip addresses are no longer blocked.

We initially assessed and noticed on one server issue as we could not block spam ip from spamming site in CSF it was still continueing. Then we replicated on 8 other servers and noticed CSF was not blocking on any...

So I have been searching for two days and I am not coming up with a clear answer to my questions. I have a managed server by another company were I do not receive any excess mailman resource messages and I checked the settings under csf.pignore

I am receiving multiples of these errors hourly:

Time: Fri Aug 27 16:11:53 2021 -0400
Account: mailman
Resource: Process Time
Exceeded: 55985 > 1800...